How scf13/ghostscan works
GhostScan is a modular penetration-testing framework. Its main workflow accepts a target, enforces scope, performs reconnaissance and web analysis, checks for vulnerabilities, then correlates and scores findings for reports and adaptive next steps. Optional plugins add checks; browser analysis and WAF evasion extend web scanning, while integrated Kali tools support discovery and testing. The graph follows README capabilities and sampled call sites; several module internals and the reporting wiring were not sampled, so uncertain links are omitted.
Main entry points: ghostscan.py CLI and scan orchestration · base.py Plugin sandbox · web_analysis.py Web analysis · tool_integration.py Security tool adapters
Components 20
Scan control
- CLI and scan orchestration
ghostscan.py - Scope enforcement
modules/scope.py - Parallel execution
modules/executor.py
Discovery
- Reconnaissance
modules/recon.py - Security tool adapters
modules/tool_integration.py - Web analysis
modules/web_analysis.py - Wordlist selection
modules/wordlists.py
Analysis and testing
- Vulnerability checks
modules/vuln_detection.py - Browser scanning
modules/browser.py - WAF evasion
modules/waf_bypass.py
Assessment and guidance
- Scoring and correlation
modules/intelligence.py - Finding normalisation
modules/normaliser.py - Report generation
modules/reporting.py - Adaptive next steps
modules/workflow.py
Extensions
- Plugin sandbox
plugins/base.py - Admin finder
plugins/admin_finder.py - Sensitive file checks
plugins/sensitive_files.py - Custom XSS checks
plugins/xss_custom.py
Other components
- Tester
- Target
Connections 26
- Tester → CLI and scan orchestration: configures scan
- CLI and scan orchestration → Scope enforcement: checks target
- Scope enforcement → Target: permits access
- CLI and scan orchestration → Reconnaissance: starts recon
- CLI and scan orchestration → Web analysis: starts web scan
- CLI and scan orchestration → Vulnerability checks: starts checks
- CLI and scan orchestration → Plugin sandbox: loads plugins
- CLI and scan orchestration → Scoring and correlation: analyses results
- CLI and scan orchestration → Report generation: requests report
- CLI and scan orchestration → Adaptive next steps: requests guidance
- CLI and scan orchestration → Parallel execution: dispatches tasks
- Reconnaissance → Security tool adapters: runs tools
- Web analysis → Security tool adapters: runs tools
- Web analysis → Wordlist selection: selects lists
- Web analysis → WAF evasion: applies evasion
- Web analysis → Browser scanning: uses browser
- Vulnerability checks → Security tool adapters: runs tools
- Plugin sandbox → Admin finder: runs plugin
- Plugin sandbox → Sensitive file checks: runs plugin
- Plugin sandbox → Custom XSS checks: runs plugin
- Admin finder → Plugin sandbox: returns findings
- Sensitive file checks → Plugin sandbox: returns findings
- Custom XSS checks → Plugin sandbox: returns findings
- Scoring and correlation → Finding normalisation: normalises findings
- Report generation → Tester: presents results
- Adaptive next steps → Tester: suggests actions